A teenaged hacker named Pinkie Pie breaks out of Chrome's security sandbox.

After exploiting six different Chrome vulnerabilities, a hacker named Pinkie Pie was able to display this image on his target machine.

Dan Goodin

An exploit that fetched a teenage hacker a $60,000 bounty targeted six different security bugs to break out of the security sandbox fortifying Google's Chrome browser.

The extreme lengths taken in March by a hacker identified only as Pinkie Pie underscore the difficulty of piercing this safety perimeter. Google developers have erected their sandbox to separate Web content from sensitive operating-system functions, such as the ability to read and write files to a hard drive. Such sandboxes are designed to minimize the damage that can be done when attackers identify and exploit buffer overflows and other types of software bugs that inevitably find their way into complex bodies of code.

Pinkie Pie's attack came during Pwnium, a contest that awarded $60,000 prizes to hackers who successfully broke out of the protective barrier by exploiting only vulnerabilities residing in code that is native to the Google browser. The teenager was one of only two contestants to win the top prize. He did it after executing a custom-written Netscape Plugin Application Programming Interface directly on a Dell Inspiron laptop that ran a fully patched version of Chrome on a fully patched version of Microsoft's Windows 7 operating system. Google patched the severest of the vulnerabilities within 24 hours of them being exploited.

According to technical details Google published Tuesday, Pinkie Pie's odyssey began by exploiting a bug in a prerendering engine that helps Chrome work faster by gathering clues about webpages before they're loaded. By combining the attack with a second one that exploited a separate bug, he was able to inject a tiny, eight-byte address into a highly restricted section of the browser that processes commands sent to graphics cards.

By guessing some predictable addresses allocated by Windows, he was able to execute the snippet using a technique known as return-oriented programming, which extracts pieces of code present in executable memory areas and rearranges them to form a malicious payload. Although graphics processes are sandboxed, their restrictions are more permissive than the parts of Chrome that render HTML and Native Client processes. That allowed the hacker to tap Chrome's inter-process communications channel—which allows different parts of the browser to work together—and exploit two additional bugs described here and here. They allowed his code to gain additional privileges so it could access the part of Chrome that runs NPAPI plugins. (Note: To keep similar bugs from being exploited in other programs, Google is delaying the disclosure of some details. Some of these links may not work immediately.)

By exploiting two more bugs here and here, he was finally able to break out of the sandbox. The Dell Inspiron responded by displaying an image of a pink pony wielding a medieval axe, but it could just as easily have loaded a backdoor trojan that gave Pinkie Pie complete control over the machine.

Pinkie Pie speaks

In an e-mail that arrived after this article was published, Pinkie Pie said Google's deep-dive analysis varied widely from the way he thought about the attack when he was fashioning it.

"It's interesting to see the bugs listed this way because when writing the exploit I only counted three bugs, not six," he wrote. "117417, 117715, and 117736 are all hardening measures that enforce security boundaries that don't strictly need to exist, which I guess is a good thing."

He went on to say he wasn't sure if he could break out of Chrome's sandbox a second time.

"Finding vulnerabilities is very luck based, and a new exploit would likely use a totally different code path," he explained. "But keep in mind that to be eligible for the $60,000, I had to use only bugs in Chrome itself, not the operating system, which is a fairly severe restriction compared to a real attack."

He also noted that the successful attack of Sergey Glazunov, the other Pwnium contestant to take home a $60,000 prize, "relied on roughly 10 distinct bugs," according to the Google blog post. An upcoming post will contain the details, Google promised.

The exploit underscores the hacking truism that it can take a single teenager days to break what hundreds of highly paid professionals have spent years to build. While Pinkie Pie's journey was painstaking, he said at the time that it took him only about 10 days to plan and execute it. The episode also explains why Google to date has awarded more than $500,000 to hackers who privately report vulnerabilities in its software and services. Sometimes, the only way to erect an impenetrable castle is to occasionally watch it come crashing down.

Promoted Comments

The skill of this hacker boggles the mind. I have a com sci degree and most of this is still way out of my league. The complexity of this hack both demonstrates the strength of Chrome's security and reinforces the truism that no security is perfect.

How the hell does a teenager learn all this stuff? Mind you, programming is fun but hacking? Sure, the final result IS fun but wading through bits and bytes? Sheesh. I admire this story and this kid. Simply amazing.

Lots of books, lots of random tutorial PDFs translated from Russian, and most importantly, lots and lots of time in OllyDbg. Everyone I know who is like this started as a young teen and was/is obsessed with it.

And in the distant past, SoftICE, and SmartCheck. And the tuts by the masters of the dark art of reverse engineering.

I learned by breaking copy protection on games -- I really really wanted to play the games the cool kids had but I couldn't afford to buy (heart-breaking stuff, I know). You just need the motivation -- it also helps if you like solving problems, which is pretty much all programming is.

Kudos to Google for rewarding people who directly contribute to their product (and help protect Google's brand).

Since 6 bugs are needed to break out of Chrome's sandbox, isn't it unlikely that this attack would have worked in the real world?

Especially if some of the 'bugs' needed specific steps done for them to work? That said, it's good that people are pointing out these bugs to Google and getting them fixed.

Abresh, it sounds like you don't understand how this contest works. Per the rules, entrants took a fully patched machine and pointed it at a booby-trapped website. If the website was able to execute code on the computer using only code native to Chrome, the person won the $60,000 prize.

In other words, Pinkie Pie's attack *did* work in the real world. Make sense?

47 Reader Comments

Human beings are just amazing. On one end you have this teenager, who is obviously extremely intelligent and crafty, and on the other, you have adults who thought it was a good idea to put their child into a washing machine and shut the door.

The skill of this hacker boggles the mind. I have a com sci degree and most of this is still way out of my league. The complexity of this hack both demonstrates the strength of Chrome's security and reinforces the truism that no security is perfect.

How the hell does a teenager learn all this stuff? Mind you, programming is fun but hacking? Sure, the final result IS fun but wading through bits and bytes? Sheesh. I admire this story and this kid. Simply amazing.

How the hell does a teenager learn all this stuff? Mind you, programming is fun but hacking? Sure, the final result IS fun but wading through bits and bytes? Sheesh. I admire this story and this kid. Simply amazing.

Lots of books, lots of random tutorial PDFs translated from Russian, and most importantly, lots and lots of time in OllyDbg. Everyone I know who is like this started as a young teen and was/is obsessed with it.

Human beings are just amazing. On one end you have this teenager, who is obviously extremely intelligent and crafty, and on the other, you have adults who thought it was a good idea to put their child into a washing machine and shut the door.

You haven't seen the movie Rainman I gather?

During the movie the character played by Tom Cruise learns that the character played by Dustin Hoffman actually did something similar to him when Tom Cruises character was a child.

How the hell does a teenager learn all this stuff? Mind you, programming is fun but hacking? Sure, the final result IS fun but wading through bits and bytes? Sheesh. I admire this story and this kid. Simply amazing.

Lots of books, lots of random tutorial PDFs translated from Russian, and most importantly, lots and lots of time in OllyDbg. Everyone I know who is like this started as a young teen and was/is obsessed with it.

And in the distant past, SoftICE, and SmartCheck. And the tuts by the masters of the dark art of reverse engineering.

If anyone's interesting in learning this stuff, you could try CMU's Bomb Lab. It's a second-year (I think) CS assignment in low-level hacking. While you won't necessarily use the same techniques as Pinkie, it's an interesting introduction if you've only learned programming and not cracking. The description, handouts and a Linux binary to hack are here: http://csapp.cs.cmu.edu/public/labs.html

CMU wrote:

A "binary bomb" is a program provided to students as an object code file. When run, it prompts the user to type in 6 different strings. If any of these is incorrect, the bomb ``explodes,'' printing an error message and logging the event on a grading server. Students must ``defuse'' their own unique bomb by disassembling and reverse engineering the program to determine what the 6 strings should be. The lab teaches students to understand assembly language, and also forces them to learn how to use a debugger.

@dacjames Simplicity is the key. Code may be run in a sandbox, the sandbox itself isn't. There is no such thing as a sandbox really. Apart from bugs people can easily be lured into executing things and disclose passwords despite all security efforts and warnings. Here is an example: http://j.mp/MlFVMF

Since 6 bugs are needed to break out of Chrome's sandbox, isn't it unlikely that this attack would have worked in the real world?Especially if some of the 'bugs' needed specific steps done for them to work? That said, it's good that people are pointing out these bugs to Google and getting them fixed.

The fact that P.P. found those bugs and demonstrated an exploit, shows that this IS feasible in the real world. In fact, as explained in the article, if P.P. had been allowed to use OS bugs as well (as a hacker would in the real world), it might have been easier to compromise the system. All it would have taken to turn this exploit into a "real world" attack, is to take Pinkie Pie's code, and plonk it onto some website (say for example, a honey trap site offering free pornography or something along those lines). If Pinkie Pie had decided to sell this as a toolkit, it could have been on thousands of websites within days...

How the hell does a teenager learn all this stuff? Mind you, programming is fun but hacking? Sure, the final result IS fun but wading through bits and bytes? Sheesh. I admire this story and this kid. Simply amazing.

Lots of books, lots of random tutorial PDFs translated from Russian, and most importantly, lots and lots of time in OllyDbg. Everyone I know who is like this started as a young teen and was/is obsessed with it.

And in the distant past, SoftICE, and SmartCheck. And the tuts by the masters of the dark art of reverse engineering.

I learned by breaking copy protection on games -- I really really wanted to play the games the cool kids had but I couldn't afford to buy (heart-breaking stuff, I know). You just need the motivation -- it also helps if you like solving problems, which is pretty much all programming is.

Kudos to Google for rewarding people who directly contribute to their product (and help protect Google's brand).

How the hell does a teenager learn all this stuff? Mind you, programming is fun but hacking? Sure, the final result IS fun but wading through bits and bytes? Sheesh. I admire this story and this kid. Simply amazing.

Lots of books, lots of random tutorial PDFs translated from Russian, and most importantly, lots and lots of time in OllyDbg. Everyone I know who is like this started as a young teen and was/is obsessed with it.

And in the distant past, SoftICE, and SmartCheck. And the tuts by the masters of the dark art of reverse engineering.

I learned by breaking copy protection on games -- I really really wanted to play the games the cool kids had but I couldn't afford to buy (heart-breaking stuff, I know). You just need the motivation -- it also helps if you like solving problems, which is pretty much all programming is.

I stumbled onto this scene before I could even program. That you could do amazing things like this without even seeing the source got me learning assembly language (MASM), and later, "normal" programming.

All this seems to have occurred eons ago. It's been about 10 years since Pietrek did an update on his article on the PE/COFF file format. His original book/article was written years before that.

My entry to this was about 10 yrs ago. I had a piece of software that required a hardware dongle, and I didn't want to carry it between my work and dorm computer. I was a cs student, and knew basic c. I found the address of the dongle (parallel port), and read it several times while launching the app. I finally found a non-zero value. At that point, I remapped the port with a service, and had it always return the value (and most of that was programs that were already available on the internet as tutorials).

Things havent really changed much. You wouldn't believe how much production code is released that was compiled with debug flags set, or pkg files with 'notes' included. I ran across one a few weeks ago where they left a file that showed how to disable the serial / reg check. Most mistakes are stuff that are known issues / bugs that keep getting repeated for various reasons. Studying what has already been done will give you a way in to most things. You wouldn't believe how many apps still dont sanitize inputs.

Abresh | Ars Scholae Palatinaereply about 7 hours agoSince 6 bugs are needed to break out of Chrome's sandbox, isn't it unlikely that this attack would have worked in the real world?

Especially if some of the 'bugs' needed specific steps done for them to work? That said, it's good that people are pointing out these bugs to Google and getting them fixed.755 posts | registered Dec 22, 2009

NO it would work BUTSo unlikely some one would stumble across them Google thought it worth $60,000.thats the whole point of the contest. the Chrome design avoids the easy and common hacks.only the rare and un-patched are valuable. turning hackers in to assets is the geniusyou cant buy this level of security research given the likely cost of unsuccessful hacksgoogle just needs the prize high enough to make the choice of recognition over illegal profit work.not to mention personal safety issues hacking on the illegal side

In the past 5 hours 33 readers clicked on an obscure link posted by an anonymous user 'EK89'. Some may also have clicked on one of the 'sign in' buttons. Risky.

Tried the link in a virtual machine out of curiousity

Same here. I generally test suspicious links this way when they crop up on sites I care about, so's I know whether to report them for the banhammer and/or post IMMEDIATE warnings about them in case it's something really, really nasty and my one flag wasn't enough to bring the banhammer down.

Since 6 bugs are needed to break out of Chrome's sandbox, isn't it unlikely that this attack would have worked in the real world?

Especially if some of the 'bugs' needed specific steps done for them to work? That said, it's good that people are pointing out these bugs to Google and getting them fixed.

Abresh, it sounds like you don't understand how this contest works. Per the rules, entrants took a fully patched machine and pointed it at a booby-trapped website. If the website was able to execute code on the computer using only code native to Chrome, the person won the $60,000 prize.

In other words, Pinkie Pie's attack *did* work in the real world. Make sense?

I sure hope they offered the kid a paid role of some kind. I can't imagine an interview process that would yield a better candidate and you'd want this kid on your side.

Not sure it would pay off. As the hacker said, a lot of this is luck-based. He looked at some vulnerabilities, pieced together some things, tested some ideas... viola... he found a way to crack the egg. But, while it does mean he has a pretty crafty mind in regards to thinking outside the box, it doesn't mean he'd be a top-notch QA person to take on.

That's why I think Google and others that participate in these pwn-2-own type competitions are crazy-smart. Sure, you have a normal QA dept. But, to field the hundreds (if not thousands) of people to hack away at your software in the fashion these contests promote... you'd be paying millions upon millions each year if they were QA employees. Instead, Google got all of this knowledge for the low, low price of $60k.

I'm not saying Google ripped off people, and got their time for free, either. It's really a win-win. People, especially smart people, love to be challenged. The thrill of the challenge alone, being that person that cracked the egg, is enough for some folks. Getting paid a fat sum at the end is just icing on the cake. Google gets tons of QA for low-cost. Techies get a challenge to sink their teeth into. Win-win.